What is the danger of using OpenID for your site?

Question

Suppose I created a website like StackOverFlow, and decided to use OpenID. What prevents me or anyone else from phishing identifiers in this case? That is, how can you really know that any site uses OpenID and does not pretend to be? And how do you protect yourself from this?

Turning around this, let's say one site compromised your openID credentials, could they use it on all other sites using openID (global password cracking)? Won't the security of your openID be as strong as the weakest website / provider?

Answer 1

All you enter is an identifier, a password. The identifier is publicly available, so phishing is not a security hole. Some providers even use the same identifier for all users, for example, the identifier for the google account is always https://www.google.com/accounts/o8/id . A more detailed explanation can be found in the Wikipedia article .

Answer 2

For users who know very little about how OpenID works, you can create several spoofing pages that look like sites running OpenID (for example, any of the free email providers that handle OpenID). If they forget to check the domain in which they are located before filling in the username and password, then evildomain now has its own OpenID username and password.

On the server side, you rely on external sites for authentication. Thus, if a hole is found in the form of the XYZ OpenID provider that allows the swordfish password to work in any account, anyone can impersonate users from this provider in any place where OpenID is accepted.

allesklar made a good point when I printed this, which goes well with my last point: if you mix local and remote users, you suddenly need two prohibition lists instead of one; a second list of prohibitions for the "bad" OpenID providers created by people to create account packages ... or those that automatically resolve the account name provided to them.

Answer 3

When someone enters an open identifier on your site, you authenticate the user by asking the site on which the OpenID user lives (and only that site), if that user is ok. For example, AOL cannot validate the Yahoo OpenID.

If the user is not yet authenticated on this site, authentication fails and you need to be redirected to the site login page. Real authentication still needs to happen, but it always happens with the OpenID provider for this user. As a user, you are protected because you only need to see the login page that you are familiar with. It will be difficult for a malicious site to synchronize OpenID credentials, as users never give these sites their passwords directly.

As soon as the user is authenticated using his provider (or if he is in "get-go" mode), the provider will report this to your website. What changes for OpenID is that your site should now trust some other sites - that they will accurately report the status to their users.

Someone might set up a “malicious” public identifier provider and try to disable the new identifiers this way, but it could be between the user and the provider. Since this authentication is about reputation, the idea is that such a provider will not stay in the business for long. If nothing else, sites may blacklist these providers. A malicious provider will not be able to impersonate public identifiers registered with other providers.

Another possibility for a malicious provider is to install the OpenID service, which always always confirms any identifier passed to it for authentication (or allows the administrator to configure a back door for it). However, this will only affect users registered with this provider. Again, sites may blacklist these suppliers, and since they take on a reputation, an idea that would not remain in the business for a long time remains.

Answer 4

The OpenID system is very secure and gets a lot of land because of this.

The main drawback that I see is that if the OpenID provider of many of your users leaves, these users will be blocked on your site. Therefore, you must have a backup plan for your username and password, after which his email address will be saved so that you can send them a password in case of emergency / disaster.

Answer 5

Funny story. I found an exploit on SO that allowed me to completely change the profile. If Jeff used email + password, I could have his account, but because SO uses OpenID, there was nothing to do but change his Gavitar to something funny.

The bug in question was fixed and I'm still waiting on my Hacker badge .: P

Answer 6

The key point that scares me is that it simply does not belong to his account on one website, but on every site using openID !!!